Questions tagged [openscap]

Open source suite of SCAP tools

15 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2
votes
1answer
528 views

How can I use openscap to do an offline OVAL scan of a Cisco router?

This doc describes a process of scanning a router's "show tech" file with a joval utility. I downloaded joval's trial, but didn't see that utility. Can openscap do offline OVAL scans of Cisco ...
1
vote
1answer
62 views

How do I cross-reference OpenSCAP benchmarks to the CIS documentation?

I'm using the SCAP WorkBench, and have gone in to customize the CIS profile for RHEL 8. The benchmark items are clearly titled with things like "Modify the System Login Banner". The item ...
1
vote
1answer
130 views

Performing an OpenSCAP Remediation via a chroot session — “Can't perform remediation in offline mode” Error

I am attempting to perform an OpenSCAP remediation through a chroot session. My command is structured as follows: oscap-chroot /mnt/chroot_fs \ xccdf eval \ --remediate \ --...
1
vote
0answers
164 views

Build SCAP files from reference system

The current way of dealing with a SCAP configuration file is unwieldy. Let's look at the process as I read it in the documentation: Take a starting config file (CIS, DISA STIG, OpenSCAP reference) ...
1
vote
1answer
401 views

How to run OpenSCAP with my own PowerShell-script

I want to check if is screensaver on my Windows 10 Pro active using my own PowerShell-script and OpenSCAP 1.3.2 (Windows version). I wrote such file test.xml: <?xml version="1.0" encoding="UTF-8"?&...
1
vote
0answers
262 views

OpenSCAP warning: obtrusive data from probe

I'm using OpenSCAP 1.3.1 on Windows 10 Professional (64-bit) with the CISecurity OVAL vulnerability definitions, schema version 5.11.1. My definition files all pass validation. I receive a lot of ...
1
vote
0answers
31 views

Verify on a client workstation that all GPOs are enforced using OpenSCAP

I would like to verify that all my GPOs are enforced on client workstations using OpenSCAP. A manual verification of each policy is not acceptable. I have exported my GPO's to an XML file but I can't ...
1
vote
0answers
61 views

oscap-vm fails to produce HTML results

I am getting started with oscap-vm, basically using openscap in an offline mode to scan VM images looking for CVEs. When I use oscap-vm installed on RHEL7.6 and scan Ubuntu images, oscap-vm fails ...
1
vote
1answer
101 views

OpenSCAP with external resources on a device with no external networking

I am attempting to scan a virtual machine generated off of a RHEL7 kickstart with some in-house configuration. Since the machine in question is still in testing, it's not yet authorized to connect out ...
0
votes
1answer
43 views

OpenSCAP for SLES 15 docker container and/or image

I see from this page that it is possible to scan either a running RHEL 7 docker container or the docker image. Is this only possible for RHEL 7 or can it be done for other operating systems? ...
0
votes
0answers
13 views

Input file cisco router config in openscap

I have a configuration file for a cisco router and I would like to integrate it as an input file on openscap. Is it technically possible? Thanks
0
votes
1answer
60 views

Anaconda openscap addon scan

I added openscap addon in kickstart. After the iso is installed, I run the scan on one vm with addon and one without addon. The scan results don't have much difference. For instance, passed 64 vs 61. ...
0
votes
1answer
177 views

SCAP - Workbench on MAC (with Remote Machine option) - Failed to create SSH master socket

I'm running latest workbench: SCAP Workbench 1.2.1, compiled with Qt 5.13.2, using OpenSCAP 1.4.0 I can't run a scan on remote server using RHEL7 (DISA STIG profile - or any profile) because of a ...
0
votes
1answer
51 views

OpenSCAP remediation won't boot

I am runnnig OenSCAP on a CentOS 6.9 box, after I run it and remediate the findings my machine won't boot. It gets to the CentOS splash screen and stops. When I hit Alt+d it will loop when loading ...
-1
votes
1answer
246 views

False positives when scanning CentOS7 with OpenSCAP

I just installed OpenSCAP Benchmark scanner on a CentOS7 box I had stigged by hand. There are a huge number of false positives showing up and I'm not sure if it's a bug or somehow it's not remediated ...